#ifndef __CAP_BPF_H_
#define __CAP_BPF_H_

#ifdef __cplusplus
extern "C" {
#endif

struct s_filter {
    pid_t pid;
    __s64 uid;
};

struct s_event_clone {
    pid_t child_pid;            // for fork, if execve child_pid = pid
};

struct s_event_execve {
    char filename[50];
};

struct s_event_capset {
    struct __user_cap_header_struct hdrp;
    struct __user_cap_data_struct datap;
};

struct s_event_setuid {
    uid_t uid;
    uid_t ruid;
    uid_t euid;
    uid_t suid;
};

struct s_event_setgid {
    gid_t pid;
    gid_t gid;
    gid_t rgid;
    gid_t egid;
    gid_t sgid;
    gid_t pgid;
};

struct s_event_prctl {
    int option;
    int arg2;
    int arg3;
    int arg4;
    int arg5;
};

struct s_cap {
    unsigned int securebits;
	__u64 cap_inheritable;
	__u64 cap_permitted;
	__u64 cap_effective;
	__u64 cap_bset;
	__u64 cap_ambient;
};

struct s_event {
    __u64 nsec;     // kerner nsec, bpf event 不保证按时间顺序传递
    int nr;         // syscall nr, -1表示进程退出
    int retvel;
    pid_t pid;
    pid_t tgid;
    pid_t ppid;
    uid_t uid;
    char comm[20];

    __u64 ustack_sz;
	__u64 ustack[20];

    struct s_cap cap_before;
    struct s_cap cap_after;

    union {
        struct s_event_clone clone;
        struct s_event_capset capset;
        struct s_event_setuid setuid;
        struct s_event_setgid setgid;
        struct s_event_execve execve;
        struct s_event_prctl prctl;
    }data;
};

struct s_maps_event {
    pid_t pid;
    pid_t tgid;
    pid_t ppid;
    int nr;
};

#ifdef __cplusplus
}
#endif
#endif
